Within a virtualized environment, reducing the footprint for each guest virtual machine (GVM) permits a greater number of machines to run on a single hardware device. While prior art techniques reduce overhead by offloading antivirus (AV) scanning and the like to a centralized resource, this also loses some of the advantages of a local malware agent. There remains a need for improved virtual machine security that provides full malware protection while reducing the footprint of each guest virtual machine.